IN THE CLAIMS : 



Please substitute the following claims for the same-numbered claims in the application: 

1. (Currently Amended) A method of automatically identifying anomalous situations during 
system operations of a computerized system , said method comprising: 

recording features of normal system operations of said computerized system in a history 

file; 

automatically creating a model for each of said features of said normal system operations 
in said history file , wherein said model comprises a mathematical statement indicating what a 
corresponding feature equals in terms of relationships with all other features : 

calculating anomaly scores of said features of said normal system operations and storing 
said anomaly scores in a trained file , wherein said anomaly scores are predictive of whether each 
of said features will be normal according to previously defined standards when one or more of 
the other features are abnormal according to previously defined standards : 

establishing a threshold to evaluate whether events in live system operations of said 
computerized system are anomalies as compared to said normal system operations; 

automatically identifying anomalous events in said live system operations based on said 
anomaly scores and on said threshold; 

reporting said anomalous events; and 

periodically repeating said calculating. 
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2. (Currently Amended) The method in claim 1, all the limitations of which are incorporated 
herein by reference, wherein said creating comprises: 

establishing relationships that exist between each of said features of said normal system 
operations; 

selecting a labeled feature from said features; 

mathematically rearranging said relationships from the point of view of said labeled 
feature to create a solution for said labeled feature, wherein said solution comprises [[a]]_said 
model for said labeled feature; 

selecting different features as said labeled feature and repeating said process of 
mathematically rearranging said relationships to produce solutions from the point of view of 
each remaining feature as models for the remaining features. 

3. (Canceled). 

4. (Currently Amended) The method in claim 2, all the limitations of which are incorporated 
herein by reference, wherein said normal system operations comprise said features in said history 
file at the time said models are created. 

5. (Currently Amended) The method in claim 1, all the limitations of which are incorporated 
herein by reference, wherein said calculating comprises: 

predicting a likelihood that said each feature will be normal when one or more of the 
other features are abnormal, using said model of each of said features; 
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repeating said predicting using different presumptions about other features being normal 
and abnormal to produce said trained file of a plurality of anomaly scores for each of said 
features. 

6. (Currently Amended) The method in claim 5, all the limitations of which are incorporated 
herein by reference, wherein said trained file provides an normally one anomaly score for each of 
said features for each of a plurality of different possible abnormalities. 

7. (Currently Amended) The method in claim 5, all the limitations of which are incorporated 
herein by reference, wherein said automatically identifying comprises: 

determining values of features for a given operation of said computerized system; 
referring to said trained file to retrieve an anomaly score for each of said features of said 
given operation; 

comparing said anomaly score for each of said features of said given operation with said 
threshold to determine whether each anomaly score exceeds said threshold. 

8. (Currently Amended) A method of automatically identifying anomalous situations during 
system operations of a computerized system , said method comprising: 

recording features of normal system operations of said computerized system in a history 

file; 

automatically creating a model for each of said features of said normal system operations 
in said history file , wherein said model comprises a mathematical statement indicating what a 
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corresponding feature equals in terms of relationships with all other features ; 

calculating anomaly scores of said features of said normal system operations and storing 
said anomaly scores in a trained file , wherein said anomaly scores are predictive of whether each 
of said features will be normal according to previously defined standards when one or more of 
the other features are abnormal according to previously defined standards ; 

establishing a threshold to evaluate whether events in live system operations of said 
computerized system are anomalies as compared to said normal system operations; 

automatically identifying anomalous events in said live system operations based on said 
anomaly scores and on said threshold; 

reporting said anomalous events; and 

periodically repeating said calculating; 

wherein said creating of said model for each of said features comprises: 

establishing relationships that exist between each of said features for said normal 
system operations; 

selecting a labeled feature from said features; 

mathematically rearranging said relationships from the point of view of said 
labeled feature to create a solution for said labeled feature, wherein said solution comprises [[a]] 
said model for said labeled feature; 

selecting different features as said labeled feature and repeating said process of 
mathematically rearranging said relationships to produce solutions from the point of view of 
each remaining feature as models for the remaining features. 
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9. (Canceled). 



10. (Currently Amended) The method in claim 8, all the limitations of which are incorporated 
herein by reference, wherein said normal system operations comprise said features in said history 
file at the time said models are created. 

1 1 . (Currently Amended) The method in claim 8, all the limitations of which are incorporated 
herein by reference, wherein said calculating comprises: 

predicting a likelihood that each feature will be normal when one or more of the other 
features are abnormal, using said model of each of said features; 

repeating said predicting using different presumptions about other features being normal 
and abnormal to produce said trained file of a plurality of anomaly scores for each of said 
features. 

12. (Currently Amended) The method in claim 11, all the limitations of which are 
incorporated herein by reference, wherein said trained file provides an normally one anomaly 
score for each of said features for each of a plurality of different possible abnoraialities. 

13. (Currently Amended) The method in claim 11, all the limitations of which are 
incorporated herein by reference, wherein said automatically identifying comprises: 

determining values of features for a given operation of said computerized system; 
referring to said trained file to retrieve an anomaly score for each of said features of said 
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given operation; 

comparing said anomaly score for each of said features of said given operation with said 
threshold to determine whether each anomaly score exceeds said threshold. 

14. (Currently Amended) A method of automatically identifying anomalous situations during 
system operations of a computerized system , said method comprising: 

recording features of normal system operations of said computerized system in a history 

file; 

automatically creating a model for each of said features of said normal system operations 
in said history file , wherein said model comprises a mathematical statement indicating what a 
corresponding feature equals in terms of relationships with all other features ; 

calculating anomaly scores of said features of said normal system operations and storing 
said anomaly scores in a trained file , wherein said anomaly scores are predictive of whether each 
of said features will be normal according to previously defined standards when one or more of 
the other features are abnormal according to previously defined standards ; 

establishing a threshold to evaluate whether events in live system operations of said 
computerized system are anomalies as compared to said normal system operations; 

automatically identifying anomalous events in said live system operations based on said 
anomaly scores and on said threshold; 

reporting said anomalous events; and 

periodically repeating said calculating; 

wherein said calculating comprises: 
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predicting a likelihood that each feature will be normal when one or more of the 
other features are abnormal, using said model of each of said features; 

repeating said predicting using different presumptions about other features being 
normal and abnormal to produce said trained file of a plurality of anomaly scores for each of said 
features. 

15. (Currently Amended) The method in claim 14, all the limitations of which are 
incorporated herein by reference, wherein said creating comprises: 

establishing relationships that exist between each of said features for said normal system 
operations; 

selecting a labeled feature from said features; 

mathematically rearranging said relationships from the point of view of said labeled 
feature to create a solution for said labeled feature, wherein said solution comprises [[a]] said 
model for said labeled feature; 

selecting different features as said labeled feature and repeating said process of 
mathematically rearranging said relationships to produce solutions from the point of view of 
each remaining feature as models for the remaining features. 

16. (Canceled). 



17. (Currently Amended) The method in claim 15, all the limitations of which are 
incorporated herein by reference, wherein said normal system operations comprise said features 
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in said history file at the time said models are created. 

18. (Currently Amended) The method in claim 14, all the limitations of which are 
incorporated herein by reference, wherein said trained file provides a normally one anomaly 
score for each of said features for each of a plurality of different possible abnormalities. 

19. (Currently Amended) The method in claim 14, all the limitations of which are 
incorporated herein by reference, wherein said automatically identifying comprises: 

determining values of features for a given operation of said computerized system; 
referring to said trained file to retrieve an anomaly score for each of said features of said 
given operation; 

comparing said anomaly score for each of said features of said given operation with said 
threshold to determine whether each anomaly score exceeds said threshold. 

20. (Currently Amended) A program storage device readable by machine, tangibly 
embodying a program of instructions executable by the machine to perform a method of 
automatically identifying anomalous situations during system operations of a computerized 
system , said method comprising: 

recording features of normal system operations of said computerized system in a history 



automatically creating a model for said each of said features of said normal system 
operations in said history file , wherein said model comprises a mathematical statement indicating 



file; 
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what a corresponding feature equals in terms of relationships with all other features ; 

calculating anomaly scores of said features of said normal system operations and storing 
said anomaly scores in a trained file , wherein said anomaly scores are predictive of whether each 
of said features will be normal according to previously defined standards when one or more of 
the other features are abnormal according to previously defined standards ; 

establishing a threshold to evaluate whether events in live system operations of said 
computerized system are anomalies as compared to said normal system operations; 

automatically identifying anomalous events in said live system operations based on said 
anomaly scores and on said threshold; 

reporting said anomalous events; and 

periodically repeating said calculating. 

21. (Currently Amended) The program storage device in claim 20, all the limitations of 
which are incorporated herein by reference, wherein creating comprises: 

establishing relationships that exist between each of said features for said normal system 
operations; 

selecting a labeled feature from said features; 

mathematically rearranging said relationships from the point of view of said labeled 
feature to create a solution for said labeled feature, wherein said solution comprises [[a]] said 
model for said labeled feature; 

selecting different features as said labeled feature and repeating said process of 
mathematically rearranging said relationships to produce solutions from the point of view of 
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each remaining feature as models for the remaining features. 

22. (Canceled). 

23. (Currently Amended) The program storage device in claim 21, all the limitations of 
which are incorporated herein by reference, wherein said normal system operations comprise 
said features in said history file at the time said models are created. 

24. (Currently Amended) The program storage device in claim 20, all the limitations of 
which are incorporated herein by reference, wherein said calculating further comprises: 

predicting a likelihood that each feature will be normal when one or more of the other 
features are abnormal, using said model of each of said features; 

repeating said predicting using different presumptions about other features being normal 
and abnormal to produce said trained file of a plurality of anomaly scores for each of said 
features. 

25. (Currently Amended) The program storage device in claim 24, all the limitations of 
which are incorporated herein by reference, wherein said trained file provides an normally one 
anomaly score for each of said features for each of a plurality of different possible abnormalities. 



26. (Currently Amended) The program storage device in claim 24, all the limitations of 
which are incorporated herein by reference, wherein said automatically identifying comprises: 
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determining values of features for a given operation of said computerized system; 
referring to said trained file to retrieve an anomaly score for each of said features of said 
given operation; 

comparing said anomaly score for each of said features of said given operation with said 
threshold to determine whether each anomaly score exceeds said threshold. 
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